CVE-2022-25210: Improper Synchronization

February 16, 2022 (updated February 26, 2022)

Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier uses static fields to store job configuration information, allowing attackers with Item/Configure permission to capture passwords of the jobs that will be configured.

References

github.com/advisories/GHSA-vwx4-frpr-w27j
nvd.nist.gov/vuln/detail/CVE-2022-25210
www.jenkins.io/security/advisory/2022-02-15/

Code Behaviors & Features

Detect and mitigate CVE-2022-25210 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →